Team Tasks.Skip

• Analyzed: Mar 31, 2026, 12:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0d95a48fdb75191064afa72ba5af0e14f3c7cc10afc1fdfa81e6ac4bd7867108
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive task management system for multi-agent pipelines (Linear, DAG, and Debate modes). The primary concern is the presence of hardcoded Telegram group IDs (e.g., -5189558203, -5218382533) in SKILL.md, which are presented as 'Session Keys' and targets for relaying task results. These instructions could lead an AI agent to exfiltrate project data to external communication channels not controlled by the user. While the core logic in scripts/task_manager.py appears to be a legitimate state manager without hidden malicious functions, the inclusion of specific, hardcoded external targets in the agent's instructions represents a significant risk of unauthorized data exposure.